Log query user interface
A series of graphical user interfaces allows a user to define rules for parsing unstructured and structured log data and generate an aggregate rule to identify events across multiple lines of one or more log files. A first graphical user interface allows a user to select a line from a log file under analysis, search for matching lines in the log file, define rules for parsing the log file, and tokenize attributes of the selected lines. A second user interface allows the user to aggregate defined rules so that messages may be correlated to identify events that occur across multiple lines.
1. A method, comprising:
streaming, in a user interface of a client device, a plurality of log files of an application executing on an application server;
responsive to receiving a pause indication at the user interface, pausing the streaming;
receiving a selection of a first line of the log files and a second of line of the log files displayed in the paused stream;
receiving a selection of one or more attributes of the first line and second line,
receiving an attribute name for each of the one or more attributes;
selecting a first rule and a second rule for parsing the plurality of log files, the first rule associated with the first line and the second rule indicated by a second rule name associated with the second line;
linking the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
receiving, from the application server at the client device, an aggregate rule created from the linked first rule and second rule; and
executing a query of the plurality of log files using the aggregate rule.
2. The method of claim 1 , wherein streaming the plurality of log files continuously displays the plurality of log files in the user interface of the client device.
3. The method of claim 1 , wherein responsive to receiving the pause indication at the user interface, a subset of log files in the stream of the plurality of log files is statically displayed on the user interface of the client device.
4. The method of claim 1 , further comprising:
while the stream of log files is paused:
displaying a search interface on the user interface,
receiving, in a search field included in the search interface, an input specifying one or more regular expressions included in the first line or the second line; and
displaying, in the search interface, one or more lines of the plurality that include the one or more specified regular expressions.
5. The method of claim 1 , wherein linking the first rule and the second rule further comprises:
receiving a selection of one or more attributes of the first rule; and
linking the selected attributes of the first rule to the second rule.
6. The method of claim 1 , wherein the log file includes one or more lines from different applications.
7. The method of claim 1 , further comprising:
receiving a plurality of lines of one or more log files from the application server at the client device.
8. The method of claim 1 , further comprising:
transmitting the linked first rule and second rule to the application server.
9. The method of claim 1 , wherein executing the query of the log file using the aggregate rule, further comprises:
receiving, at the user interface of the client device, the query of the plurality of log files; and
transmitting, to the application server, the query of the plurality of log files.
10. The method of claim 1 , wherein the log file includes one or more lines generated prior to selecting the first rule and the second rule.
11. A non-transitory computer readable storage medium storing executable computer program instructions, the instructions when executed by a processor causing the processor to:
stream, in a user interface of a client device, a plurality of log files of an application executing on an application server;
responsive to receiving a pause indication at the user interface, pause the streaming;
receive a selection of a first line of the log files and a second of line of the log files displayed in the paused stream;
receive a selection of one or more attributes of the first line and second line,
receive an attribute name for each of the one or more attributes;
select a first rule and a second rule for parsing the plurality of log files, the first rule associated with the first line and the second rule indicated by a second rule name associated with the second line;
link the first rule and second rule by associating at least one attribute name associated with first rule with the second rule name;
receive, from the application server at the client device, an aggregate rule created from the linked first rule and second rule; and
execute a query of the plurality of log files using the aggregated rule.
12. The non-transitory computer readable storage medium of claim 11 , wherein streaming the plurality of log files continuously displays the plurality of log files in the user interface of the client device.
13. The non-transitory computer readable storage medium of claim 11 , wherein responsive to receiving the pause indication at the user interface, a subset of log files of the stream of the plurality of log files is statically displayed on the user interface of the client device.
14. The non-transitory computer readable storage medium of claim 11 , wherein, the instructions, when executed by the processor, further cause the processor to:
while the stream of log files is paused:
display a search interface on the user interface,
receive, in a search field included in the search interface, an input specifying one or more regular expressions included in the first line or the second line; and
display, in the search interface, one or more lines of the plurality that include the one or more specified regular expressions.
15. The non-transitory computer readable storage medium of claim 11 , wherein, the instructions for linking the first rule and the second rule, when executed by the processor, further cause the processor to:
receive a selection of one or more attributes of the first rule; and
link the selected attributes of the first rule to the second rule.
16. The non-transitory computer readable storage medium of claim 11 , wherein the log file includes one or more lines from different applications.
17. The non-transitory computer readable storage medium of claim 11 , wherein, the instructions, when executed by the processor, further cause the processor to:
receive the stream of the plurality of lines of one or more log files from the application server at the client device.
18. The non-transitory computer readable storage medium of claim 11 , wherein, the instructions, when executed by the processor, further cause the processor to:
transmit the linked first rule and second rule to the application server.
19. The non-transitory computer readable storage medium of claim 11 , wherein, the instructions for executing the query of the log file using the aggregate rule, when executed by the processor, further cause the processor to:
receive, at the user interface of the client device, the query of the plurality of log files; and
transmit, to the application server, the query of the plurality of log files.
20. The non-transitory computer readable storage medium of claim 11 , wherein the log file includes one or more lines generated prior to selecting the first rule and the second rule.